2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
metadata.json
Size 13B
Sample260724-gm5ehsgq4z
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Score

6^/10

execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
832	cmd.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\json_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\json_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.json	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\꽚뙵谁簁\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\json_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\json_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\꽚뙵谁簁	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\json_auto_file\shell	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5920	firefox.exe
Token: SeDebugPrivilege	5920	firefox.exe
Token: SeDebugPrivilege	5920	firefox.exe
Token: SeDebugPrivilege	5920	firefox.exe
Token: SeDebugPrivilege	5920	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2568	OpenWith.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe
5920	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 3472	2568	OpenWith.exe	91
PID 3472 wrote to memory of 5920	3472	firefox.exe	92
PID 3472 wrote to memory of 5920	3472	firefox.exe	92
PID 5920 wrote to memory of 3568	5920	firefox.exe	93
PID 5920 wrote to memory of 3568	5920	firefox.exe	93
PID 5920 wrote to memory of 3568	5920	firefox.exe	93
PID 5920 wrote to memory of 3020	5920	firefox.exe	95
PID 5920 wrote to memory of 3020	5920	firefox.exe	95
PID 5920 wrote to memory of 3020	5920	firefox.exe	95
PID 5920 wrote to memory of 3020	5920	firefox.exe	95
PID 5920 wrote to memory of 4308	5920	firefox.exe	96
PID 5920 wrote to memory of 4308	5920	firefox.exe	96
PID 5920 wrote to memory of 4308	5920	firefox.exe	96
PID 5920 wrote to memory of 4308	5920	firefox.exe	96
PID 5920 wrote to memory of 2856	5920	firefox.exe	97
PID 5920 wrote to memory of 2856	5920	firefox.exe	97
PID 5920 wrote to memory of 2856	5920	firefox.exe	97
PID 5920 wrote to memory of 5948	5920	firefox.exe	98
PID 5920 wrote to memory of 5948	5920	firefox.exe	98
PID 5920 wrote to memory of 5948	5920	firefox.exe	98
PID 5920 wrote to memory of 5948	5920	firefox.exe	98
PID 5920 wrote to memory of 4200	5920	firefox.exe	99
PID 5920 wrote to memory of 4200	5920	firefox.exe	99
PID 5920 wrote to memory of 4200	5920	firefox.exe	99
PID 5920 wrote to memory of 4200	5920	firefox.exe	99
PID 5920 wrote to memory of 1600	5920	firefox.exe	100
PID 5920 wrote to memory of 1600	5920	firefox.exe	100
PID 5920 wrote to memory of 1600	5920	firefox.exe	100
PID 5920 wrote to memory of 1600	5920	firefox.exe	100
PID 5920 wrote to memory of 5088	5920	firefox.exe	101
PID 5920 wrote to memory of 5088	5920	firefox.exe	101
PID 5920 wrote to memory of 5088	5920	firefox.exe	101
PID 5920 wrote to memory of 5088	5920	firefox.exe	101
PID 5920 wrote to memory of 920	5920	firefox.exe	102
PID 5920 wrote to memory of 920	5920	firefox.exe	102
PID 5920 wrote to memory of 920	5920	firefox.exe	102
PID 5920 wrote to memory of 920	5920	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\metadata.json
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\metadata.json"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\metadata.json
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {a31e24b1-7339-4b5b-85b0-978556407036} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {9497f1a6-2fc2-488e-9b38-02eea2b13d6d} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 27323 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {5e260796-7135-48b7-b3fc-224644b500de} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27323 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4124 -initialChannelId {7ec5beaf-8cf6-4129-8788-c1b5a1cc3ac5} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2732 -prefsLen 34822 -prefMapHandle 2880 -prefMapSize 270279 -jsInitHandle 2996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2608 -initialChannelId {f0230367-686d-495a-bb56-0db1bc52dbd4} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 35010 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 4668 -initialChannelId {dfbe6f1a-e533-4597-afb7-32f816f25c8f} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5420 -prefsLen 32952 -prefMapHandle 5424 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5436 -initialChannelId {ffa36439-3c4a-4776-aa3c-d27cd40178c8} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {262aa137-a4b3-4c05-8081-6df822108295} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 32952 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5768 -initialChannelId {9eb06ea1-4a75-46af-a8a1-12b1b05c3ae0} -parentPid 5920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4DDF99D0461C50BB47DC9EC040A8AD4C9355497C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\4DDF99D0461C50BB47DC9EC040A8AD4C9355497C
Size 3.8MB
SHA256 fe44647863fb341ae6ba990f4ec24d0c203c2e683a7e4fa9b92c6dd27f45a49f
MD5 902ecab983a6dc86ba6399e370acb3b3
SHA1 aa6d89f1b0976b09b3483fcce7760d420569d356
SHA512 3472989503a490774928356e66a6d915c109938541e1a5f5988fb637194050109de964990c046ad0fb552c259b9627fdc7bb7ce8e52f3ec7f482eae1dadf972f
SSDEEP 49152:txjBnLMLVNXElX0KvW+d1wFf9NWS3Aud5OSuKZgvSuCoK9OQxr3qmABb02skPQ0O:bjBb0/4Q9NLiSZgvjCoQxBctPQ0R8
TLSH
T10906F175DE9C1609C9FF83FE850C2FC2984C4FAE805CA96B7A6E99F15CA31E61F44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 1f62b3850cbc2dfa0da0f4b38525ae4ceb6d202acb841a1f70238679005c4863
MD5 472c138d67fd858d9d82b49942c649dc
SHA1 7cb47ab94dab5a45f69ecdc3d7af0b76279d203c
SHA512 9c83c5cf534e9b2008999b39c1601f050bcdb30b0bf143fe1b05f5c73f1e94d92e4fe0f5259d3094960c2faead4f3dfa9cf3ec3b167d6ada154bee378f8dbfad
SSDEEP 384:HwCe7iO024Y6dcs3hk2nhfdDE2Ba/rIVy8eeA2+6A2+R:QqZY6dv3hk2nhfS2sDIVy8N+s+R
TLSH
T15A728DBF9F416C5D2917E989C8A95369DC05F9ABCFF6D0A608243449C784326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 92a360a809e76b8863dac126a588e55df46657be76827b1ae680f7f8a8986511
MD5 b33ff2f91d83956f7c0344bf8c9e2a74
SHA1 c5fc65c2b5f290094d86d66d56f05c5cb547a8bd
SHA512 6345d56ace9a6f00f2dc8cf28562999d270c18babe21fb702e722297f1c6730e8d6ec8846c806d15fe924bcbef640e13c4ef0624a4867372f89603e19280ac50
SSDEEP 192:ECR1d66JoztdzgCl6mc0d0Ov5zbo7+ZOQyj7M:Xd66Joz/zgC1jVboqZOQyj
TLSH
T170E11E68E628867FC008037BCCA51F410F76398AD84E3F19759C641D2D5A2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1688165e3522507a0a311223dbc935112d0fda017fbf78d728e437d3ec7e2269
MD5 28e7cece7543a7f24c1467c8988d1339
SHA1 ada97742c19d1e3733ea717a3e39a8e32cec18eb
SHA512 9faa4772e36cf76d5c50c13c480d6254dc9bb04a824930f60070273c8c69d60265c72241953987451c70c2ef36132570f20d42dca335e38261747835941088d1
SSDEEP 192:SOv5zboabOQyjrxeCR1d66JoztdzgCl6mc0dz:RboabOQyjPd66Joz/zgC1jd
TLSH
T1D8D10C68F639463FC048023BCCA51F500F76794AA85E3F1971DC641D2D9A2DEBA8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 97f8615f9c6c1bb87e92f7776c06454d94e1926d44168c1dca7e982c36f3143b
MD5 774c6a391c26a14a2ae80802a2d39897
SHA1 6f32d939c80d5f3f8818d83da706cefd5471fc20
SHA512 428dcd51974677129ecd3ca90d0eb2919dc5333e6cb69927ca73b949eebe1a8a6cb5352b0593de8a368c11574ab65789d2d1f42441dc744e4bfe1dbe2db8624a
SSDEEP 384:+2Crc/VZdPPQvGcm+ur0Ibm9oKqn19UbsbBvEboUOQyjvd66Joz/zgC1jd:+2NdgvGcm+urB1Kqn19UbsbFsFF1/
TLSH
T1ADD2F044EB2A953FD41412BBDCA547002F79B88A991A2F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 89f37cbb8da2a5c3e6153e13b84d5d625c6f9d7982f8992c722ed771f8b8d670
MD5 5e2431e7f34597df27bc64b946f4d6d6
SHA1 514868de2bc9864101166078d85be5308ae076d5
SHA512 08dbe354db22f3ddda0e2104fa54fbafa79c4e933cf6f3252759e9780366e9d19b56d73e58df312091a782aef01be6d3bc5a53b1cea1369184b44d515f36801b
SSDEEP 384:5boUOQyjvd66Joz/zgC1jt2Crc/VZdPPQvGcm+ur0Ibm9oKqn19UbsbBv:ZFF1f2NdgvGcm+urB1Kqn19UbsbF
TLSH
T12ED2F044EB2A953FD41412BBDCA547002F79B88A991A2F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 9a3f5b3d9679ac462ecf80c817740ffd3033d8dd5fcd5581cd2121f4ea0d06ad
MD5 ec4ddb63dbfbd93d25faa63e763dfbcf
SHA1 c154b367ea9b9bf21859285ac0dcaed94a98a740
SHA512 1daed526055b4d902d5651f479ae9a4e0d624ae8d3e83bb9371e4ef2579440726cc6889d4c6af2ecbc0ad05e74eaff20d9829510073edf3c9253025636f4131e
SSDEEP 384:Xd66Joz/zgC1jt2Crc/VZdPPQvGcm+ur0Ibm9oKqn19UbsbBvEboUOQyjq:g1f2NdgvGcm+urB1Kqn19UbsbFsFl
TLSH
T14CD2F044EB2A953FD41412BBDCA547002F79B88A991A2F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f2dc5fc2db10a25d09e5d90e4dd47bac1a47b318c5b9f0c9ef64afa6ea9455bf
MD5 2b9da8a20744cf589b4641ae4edb77c9
SHA1 f97beb4916a5ecbe2a07354c1b47ed47bffe45e7
SHA512 827e0f130cc9f0b79b3e3fc7780c4961773b6fdeef0a7be978ec924cef0e8756dee355ede836b707f77245d671c8c6e35bd456a54c946f75493eda3fa8be1713
TLSH
T1E0216A8C3EB84D2A5DCAF69874A0128E5B528A0304971D435D62FF8CCE81ED9366E529
MD5 SHA1 SHA512 TLSH

Submit Download

39078a4c-95d4-45e9-96e3-6eac474092e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\39078a4c-95d4-45e9-96e3-6eac474092e9
Size 883B
SHA256 864d699ac87957217bd8d34fa12cc23bc7dcc9c91ba2874a60f1cfeb9b43e209
MD5 e68465e230c2dcbaa8dda71f6b9d494c
SHA1 f1e07fa2a812e4af768b2c01e50b5d42ddd75880
SHA512 dd644d2fa9cabec46ab911fe88dcd6306540a63223e5c9d923f89a053f9d49c3380fbfd383565ce3b714755de749ef41c50a808224d7fc00c645c57b296c603b
TLSH
T108110091A635B9F1CC78C28B89A5770787E4A52380C744103DE09E180EBE61AD76B70B
MD5 SHA1 SHA512 TLSH

Submit Download

40621a15-e2e1-49d7-a1e9-386c54023e6b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\40621a15-e2e1-49d7-a1e9-386c54023e6b
Size 235B
SHA256 dba398f97791b94ac9271d00c0d79831b442cb0eac48f367b44e8b3884945d28
MD5 0d0dc4990e062925f348651b18a7ce2a
SHA1 083119cdae2ceb6eb0f4f774c6f88b1518619943
SHA512 43fb243a33334f460fac191ef9b7cac875fb68aba4ecafb909d0b98c4ec943bf4b84c03c71338806da70e024d47a97f79fd4a1e52fd3066a11edb69efdb49a70
TLSH
T1B0D0978428D8276C4C102F52F0F239C2309A4E3324625C10D69080B4DAF9ACC0312C2B
MD5 SHA1 SHA512 TLSH

Submit Download

bd6977a4-63d7-4a96-bbac-442afad9ea8b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\bd6977a4-63d7-4a96-bbac-442afad9ea8b
Size 16KB
SHA256 44b42649fff9dba1b6ae6712af637d3f418ccfdcdd5d4c1b8d43fd95a1fc84ef
MD5 d568319fda285a6f70ad132b1640ac4e
SHA1 571f39562fc455103878f37869fc7418edaf2a4b
SHA512 96713665da237effc6ba7894919d2cc5e7aa1753f5fa09d0d14998af0e4fecad0ed36fc86907ca45f6c21d74d672591e2d37353d2cc11476cc8421ce82adfa42
SSDEEP 192:oPWLuBMuGY1LEeEunS6bz1RInCwJ49eaXP4ots6Vg6edU3CcWUP1aGxuZ8ARcZ+g:6iuGZeLnS6bBRISe2P4RZnY8Rqn
TLSH
T17572B916686055BAC651E3A898B87FC3E1F638CF4C419FCE8BE4BD485DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9b5ba48-9baf-4688-a295-d361ebfc0a8e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\c9b5ba48-9baf-4688-a295-d361ebfc0a8e
Size 235B
SHA256 5cf9235ace8b1d6aa14a37f57846d6edb22aa73d253f6916a581ed82337d7aca
MD5 7eff6b8dc78391f3839163ee747f7a3d
SHA1 8a0e17a9c0d7c39cec36763682351a7de61b0a4e
SHA512 428fb21f45f5d73a273a9c0c9ed4e1f60a563ea25b74008709fd4d04aaa284cde5e4dc5ad0072f23ea18c08940ef8398474832f4b0015692b83cebd8f7db13e6
TLSH
T18CD097802CA86B5E08100F0BB0E069C671848C331578A810FE5206389AF9EC4011181B
MD5 SHA1 SHA512 TLSH

Submit Download

cb5754ba-7c91-43a6-9edd-9d51e184805f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\cb5754ba-7c91-43a6-9edd-9d51e184805f
Size 2KB
SHA256 1efc0fe8c152661f808d379c0c605072418a12f0a57f2983354fb03bb5e94328
MD5 db35433f9d4ed899e2605f36923c4883
SHA1 90cac824fe8d11fd191a21621814c829e9d79f2a
SHA512 f846d6ed25c207c74058bc6d8791286eef0e2414262c689a0feef1e5d6c394d3e5e4138f8d9df9a96db293e84e7262b5dce72d108693900ae94d9a74e5e63329
TLSH
T11841535C38785D769CCAE58DA481338E97649A0350C32C436D41FF0CCE9639E736B62B
MD5 SHA1 SHA512 TLSH

Submit Download

d306abb6-f0f9-4504-bcb2-b11ad78c19a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\d306abb6-f0f9-4504-bcb2-b11ad78c19a2
Size 886B
SHA256 b058a0d2d6cbe5ec5423e7bc3da3a7791496ed10ba0946e6833c0d84d3f624ae
MD5 f8dd675432c60b16e4540dbd1279a113
SHA1 7fa7ac60c40aa404e8906d1ef92dc52a25f8d145
SHA512 b49202c1cdb9b46b611ac90887cfbccc41d712ae510dea9ee317f1f063124a3d24d4f6124f1257cd94d6185ac563c2006831096488a2bfbeb48c0ca1d0312fae
TLSH
T107110081D67478B2CC68928B88D1B74387E4A123C0CB09147D909F180EFE21BE76B70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extensions.json.tmp
Size 16KB
SHA256 cfdd9ab5c180319403d3a6db6b35619f497b61141fa0e0799ff67af82e6a2d3f
MD5 5dd88eefb7be3c7c7aac9253440fbcf6
SHA1 f315d5bc878c792b5bc2cfb850df463bbcb5bc56
SHA512 f1c52e9797137482f47d52b8cef22051175df8f93af812c65c6e56a1978fef9967bcc8c1307081025439b66766f723a70ea36277563817ec945a2cac0af85e36
SSDEEP 384:fkI4v/Umldv+8dhWn94zc96o/AL4H4L4PmL4H4L4H+L4HoDt4hQZ:sI4nRfzXa4c6wi464U464k4s4S
TLSH
T1A672421545149EB8298FA78AAA367E01C37D533B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 810226803c90fc4f6d0cf22c4da3cefd12a5404165ad31bd78f078de96bbe10b
MD5 1bcd055034b4811332291034c498564f
SHA1 b6cce5743bc31bbc3dd05d90be5377c3bc5b7571
SHA512 aec08881819cdc42c72efabcd452b46a7b5f9516efbe217c69b299256d255ca1e879b9e984adbd954f1b04196b1dfdd3b104140bfae8ed5f9da073d18d7634b1
SSDEEP 96:xHYUTUmDqGqmfOCs1zS2eSSlvdv9jsnKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOCs/eSS15Bkqa7Bw88W
TLSH
T139E110789508CF7F74B6766CAC6888316AB2023BBBBF28C650B554C4055CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 7KB
SHA256 fcc9bb7b63c66f1d16d2bbe4acc0f13b94bb669f87559898e19496d4f7b797e2
MD5 1c8a18ceaf68725e305211db71581e67
SHA1 5c294bf42c6b0105ac67bb3eee99461146cbb99f
SHA512 258188b38b7ce857797da06a261d0a37ca1b55843625044f2fe939a09e220c94b4e4eaa6cf563dbb0c6f9abd92da70c2d07b8410b51073bc31e6102535413ca2
SSDEEP 192:23A/UAY5ORmf2VLqnSSV5Bkqa/LuBw88M:KpTfNw8
TLSH
T17AF11F789508CF7F74B6726CAC6489316AB2023BB7BF68C650BA5484054CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 210db07f549edd702439b1311074f579907ea553057d118bfeb91603adf5b933
MD5 fad33a98315882cc1a5fc23dc8eaa213
SHA1 f99abb72a450bf95015d296eab5e1b5ea2d2cb07
SHA512 fcd66f37954360246809fd61733227414179f47080a6d2378af128a0f3752d5d03dc213a44f741b7331a946cf03beb08bdf02c68813ab794c82ae8fc5c617903
SSDEEP 96:xHYUTUmDqGqmfOLq1zSZXSSlvdv9j4nKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOLqQSSV5Bkqa7Bw88W
TLSH
T17EE12F789508CF7F74B676ACAC688C316AB2013BB7BF28C650B55484055CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 30420cf8855c64521a033876e14e27ce4770d083bf51d34a5905d50d9251af40
MD5 8c38343220e488dd02e6b0dd65413630
SHA1 84969c2ad18d99f0d5597df4461ec76037420f6e
SHA512 f644805be7770bd73e1c750f47c140022315ca17ab50d04df0debb16f2173269a908eb1f901adda544be4ea57dd73a5c9bff050e0436ed49fd7ac6c2477fe3e3
TLSH
T15E212B93984B3EF3F741C009A0C8CFD988A730340074C1A0C5A1EB11527542CB78573E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 32c6dbbe18561eb58fc1da2f62ff1aebfa431d564e02069e4591e171ec41a9e4
MD5 52a16f337c2384876fa06f2f0fe8e7eb
SHA1 315c4c379e26ef0f397e545ee5d7068ac63dcabd
SHA512 bc8e92b86b5d298d1ee118b3a32d2e752e2d30aeb39b755a832f72312b7f443c116f996630dbacb6c8b9239e6a8f1e25f54e38b70900da4c939ca21277df7310
TLSH
T18421E9939E5F3FE32754C50B90CDAF9C8DE1902542A4EB70D941B61105D88247B9EB2F
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.1MB
SHA256 5641f991ac35c34e39790955e5630803e1058328bedfdddbb65c6ebf61fef9ce
MD5 439fd752895da2bc3d0b8f749f3bf53e
SHA1 e06c530641dd0ce8f42c5e2cfef36f5f82bcf5f1
SHA512 000db06d75a5e5a5ea021587574937910cd8bd83858eff15b4d64370e5794d743841387df2a985de68b9537b6bd73dacfbe70185229a67c5f5206dfcce29abe4
SSDEEP 24576:OpT3MkqtjP+ytCc/bjSYMaHdj/EtP7PSIFaAvKZkRdp5nKjXgDTPL9fwM/VL0iy:OpT3MtB1CySYXj/mbSqdv0kRdp5Kjmf
TLSH
T1365639E860D1D243F3864073B24993EB21EFD00D5037DE0857A55AE9A5748EF8E27BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads